[atyrode]

Problem

A launch needed a model list checked against the account pool, and the panel made that a separate, repeated step: Verify models came back as the main action whenever the list in use stopped holding (a first launch, a new workspace, an account change), each workspace paid for its own check of the same accounts, and every check asked for its charge again.

Change

• Launch is always the main action. When the list in use cannot serve the launch (never checked, a routed model OMP no longer lists, or a lead the accounts no longer serve), the press runs the model check, then reviews and launches. A check that narrows the profile stops and says what moved; a stop or a failed review ends the press without retrying.
• The charge is approved once per person. The first charge asks; approving records a standing approval (approveChecks). Later checks within twice that charge spend without asking, re-reading the approval just before their first benchmark request (unasked). Setup's checks fact shows the bound and ask first withdraws it, stopping a check that is measuring under it.
• Checks belong to the person. A verified list a check stages is kept as the checking person's check of its exact account pool and budget (checks/<person>/<budget>/<pool>, the 16 most recent). Another workspace whose saved choices select that pool adopts it (adoptCheck) instead of spending: on its first Launch press, or in the background once it is set up. Only a person whose sign-in reaches the workspace root keeps checks; agents, services and confined sign-ins keep none (readChecks().keeps), and every stored record is bound to its principal and key.
• Checks renew in the background. When the list in use no longer holds, the panel adopts a newer kept check or, for a list that passed a check, renews it within the approval. A background check never asks, never spends for a list that never passed a check (adopt-only, no inventory), holds its first write until nothing the person started is in flight, and after any stop stays quiet until a person-started check completes. Meanwhile Launch keeps working with the last list that passed; failures show in Models only.
• Wording. "Check" replaces "verify" in every user-facing string.
• New doors readChecks, approveChecks (container-graded, no container capability) and adoptCheck; CatalogVerificationSchema gains a required budget. Docs: README, docs/configuration.md, docs/status.md, docs/manifold-transition.md, AGENTS invariant 3.

Dependencies

None.

Evidence

• scripts/gate.sh at bef28e458313e5a3d606122eda7a0fccc96a722f: exit 0; TypeScript check clean; bun test 451 pass, 0 fail; four bundles packed; browser verifier PASS (478s).
• Unit: workflow tests for kept checks and adoption (pool, budget, provider bound, principal and key binding, confined and ceiling sign-ins), approval bound and unasked re-read, adopt-only; pure tests for spendsWithoutAsking, adoptsOnly, backgroundCheckDue.
• Browser verifier (real Chromium, disposable server, real pinned OMP bundles): first approve then an unasked check of another pool; adoption on a Launch press and in the background with no inventory or benchmark; changed accounts keep Launch ready while a renewal runs, then the renewal puts a list checked for the new pool in use; a stopped approve press is not retried and its stop line stays; ask first withdraws; main-line approve geometry from 170 to 1440 px, coarse targets and reduced motion.
• Independent review: head-specific verdict posted below.

Native resources and credentials are deliberately unconfigured in the verifier: composition, refusal and rendering are not provider evidence.

Acceptance

• Launch is the main action; when the list cannot serve, the press checks, reviews and launches.
• A check's cost is approved once per person; later checks within it run without asking.
• Checks belong to the person; another workspace with the same pool adopts a kept check without spending.
• Checks renew in the background when accounts change; a failure keeps the last list that passed and Launch keeps working.

Closes #273

[atyrode]

Verdict: pass

Head: bef28e458313e5a3d606122eda7a0fccc96a722f

Independent review (three rounds, final at this head) found no remaining blockers, should-fix findings or nits. Earlier findings were fixed before this head: a Launch press that could loop on a failed review; a spend after a withdrawn approval; background writes landing under a person's step; kept checks ignoring the budget a list was derived under; background inventories for workspaces never set up; confined sign-ins keeping checks; principal and key binding of stored records; a stopped check retried in the background; and a crash when a list changed during a held scrub.

Local gate at this head: scripts/gate.sh exit 0; TypeScript check clean; bun test 451 pass, 0 fail; four bundles packed; browser verifier PASS (478s).

Not covered here: native consent, configured accounts and provider responses (the verifier's native resources are synthetic and unavailable by design).